Key Takeaways
- Legacy transport software is a security problem, not just a cost problem. Once a system stops receiving patches, every newly discovered flaw stays open permanently.
- Windows 10 support ended on 14 October 2025. Any transport system still running on it, or on an old on site server, is now unsupported unless you have paid for extended cover.
- The public sector has the same problem at scale. Government has identified hundreds of legacy systems, and around a quarter carry a high likelihood and impact of risk.
- UK GDPR makes this a board level duty. Article 32 requires appropriate technical measures, and the ICO has treated unsupported software as a security failing.
- Cloud based transport software removes the patching burden entirely. Updates, backups and access controls are handled centrally rather than left to a busy transport team.
Some things genuinely do go bump in the night. For transport operators, the unsettling noise is rarely a ghost. It is an ageing booking database sitting on a machine in the corner of the office, quietly holding the names, addresses and medical details of several thousand passengers.
Most conversations about legacy transport software focus on wasted time and rising costs. Those matter. But the sharper risk in 2026 is what happens when the software underneath your service stops being supported, and nobody in the organisation has noticed or has the budget to act.
This article looks at that risk plainly. It covers what legacy actually means, what the law expects of you, and what the evidence says about how widespread the problem has become across UK councils, the NHS, charities and commercial operators.
What counts as legacy transport software?
Legacy does not mean old. It means unsupported, or close to it. A system becomes legacy when the supplier no longer issues security patches, when it depends on hardware you cannot replace, or when the only person who understands it is one member of staff nearing retirement.
In community and accessible transport, legacy usually looks like one of five things.
- A booking database installed on a single office PC, backed up onto a memory stick if at all
- A network of spreadsheets that only work because everyone knows which tab not to touch
- Paper run sheets carried in vehicles, then filed in a cabinet nobody locks
- Software from a supplier that has been acquired, wound down, or has stopped issuing updates
- A system running on an operating system that has passed its end of support date
The last one is the sharpest and the easiest to check. Microsoft ended support for Windows 10 on 14 October 2025, which means no further security updates, fixes or technical support for machines still running it.
The National Cyber Security Centre had urged organisations to migrate before that date, warning in a 2025 blog post that an out of date operating system is a prime target for cyber criminals, and pointing to what happened after Windows XP support ended.
Why is unsupported software a security risk?
Because the flaws keep being found, and they stop being fixed. Every month, new vulnerabilities are discovered in widely used software. Supported systems receive a patch. Unsupported systems do not. The gap between what attackers know and what your system can defend against widens permanently from the end of support date.
This is not a theoretical concern for small operators. The government's own research shows the threat reaching organisations of every size and type across the UK, including the charities that run a large share of community transport in this country.
The Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology with the Home Office in April 2026, found that 43% of UK businesses and 28% of UK charities had identified a breach or attack in the previous 12 months.
The same survey found something more directly relevant to transport. Around one in five charities, 22%, said they held personal data that was not protected by techniques such as anonymisation or encryption. In transport, that personal data includes mobility needs, medical conditions and home addresses.
There is a commercial consequence too. Insurers have begun looking closely at unsupported operating systems, and organisations running them face the prospect of higher premiums, coverage exclusions, or a claim being refused if an unsupported device contributed to an incident.
How big is the legacy problem across UK public services?
Large enough that Parliament has called it out. This matters for anyone contracting with a council or an NHS trust, because the legacy question is increasingly being asked of suppliers as well as of departments themselves.
The National Audit Office published its Government cyber resilience report in January 2025. It found that departments have no fully funded remediation plans for half of their vulnerable legacy systems, and that government would not meet its aim of making critical functions cyber resilient by 2025.
The Public Accounts Committee went further. Its findings record that by January 2025, 319 legacy systems had been identified across government, with around 25% rated red for high likelihood and impact of risk, and that legacy is estimated to make up 28% of the public sector IT estate.
The Committee also noted that government does not know how many legacy systems it has in total. That is the part worth sitting with. If central government struggles to see its own estate, a small transport scheme with no dedicated IT support is unlikely to be tracking it either.
Demand is rising underneath all of this. House of Commons Library analysis of ONS projections shows 19% of the UK population aged 65 or over in 2022, rising towards 27% by 2072. Accessible transport demand grows with that curve.
What does UK GDPR require of transport operators?
Article 32 of the UK GDPR requires appropriate technical and organisational measures to keep personal data secure. The word doing the work is appropriate. What counts as appropriate depends on the sensitivity of the data and the risk the processing presents to the people involved.
Transport operators sit at the sensitive end of that scale. You hold health information, disability details, safeguarding notes and home addresses for people who are often vulnerable. The bar for appropriate security is correspondingly high.
The ICO's security outcomes guidance sets out what appropriate measures look like in practice, and the ICO has developed joint guidance with the NCSC describing the technical outcomes expected. Running software that can no longer be patched sits awkwardly against both.
Two points follow for trustees, boards and council decision makers. Responsibility for the choice of system rests with the organisation as data controller, not with the individual coordinator using it. And a documented, funded plan to move off legacy carries far more weight than an undocumented intention to get round to it.
If you want the day to day view of this, our guide to the five everyday GDPR risks in community transport covers the practices side, and our paper run sheets and data compliance guide covers the paperwork.
What else breaks when a system falls out of support?
Security gets the headlines, but it is rarely the first thing operators actually feel. The everyday failures are quieter and they compound.
- Nobody can fix it. When something breaks and the supplier has gone, there is no route to a fix and no service level to fall back on.
- Your data is stuck. Older systems often have no clean export. Moving away later becomes harder and more expensive the longer you wait.
- Integration stops. Modern systems talk to each other through APIs. Legacy systems usually cannot, which means rekeying data between finance, scheduling and reporting.
- Reporting becomes guesswork. Funders and local councils increasingly want evidence of journeys delivered, punctuality and unmet demand. Legacy systems rarely produce it without manual effort.
- Key person risk builds. If one person holds the knowledge, their retirement or absence becomes an operational emergency.
None of this is dramatic on any given day. That is precisely why it persists. The cost of a legacy system is paid in small increments by people who are too busy delivering journeys to add it up. Our report on the hidden costs of legacy transport software puts numbers to that side of it.
What should transport operators do about it?
Start with a simple audit. You do not need an IT department or a consultant to answer the first set of questions, and the answers will tell you quickly whether you have a problem that needs a plan.
- List every place passenger data lives, including spreadsheets, inboxes, paper files and personal phones
- Check the operating system on any machine holding that data, and confirm whether it is still supported
- Confirm who your software supplier is, whether they are still trading, and when they last issued an update
- Test whether you can export your data in a usable format, and do it before you need to
- Check your backups actually restore, rather than assuming they run
- Record what you find and take it to your board, trustees or senior management team
That last step matters more than it looks. A written record showing you identified the risk and set out a plan is exactly the kind of evidence that protects an organisation if something later goes wrong. It also tends to unlock budget in a way that verbal concern does not.
If the prospect of changing systems is the thing holding you back rather than the cost, our article on overcoming the fear of change in community transport deals with that directly.
How does modern transport software reduce the risk?
Chiefly by taking the burden off you. With cloud based transport software, patching, backups and infrastructure security are handled centrally and continuously. There is no server in the office to maintain, and no version of the system quietly falling out of support while everyone is busy.
The practical differences show up across the whole operation.
- Security updates are automatic. Patches are applied centrally rather than depending on someone remembering
- Access is controlled by role. Coordinators, drivers and passengers each see only what they need to see
- Everything is auditable. Allocations, changes and communications are recorded, which supports both safeguarding and subject access requests
- Data stays in one place. Rather than scattered across inboxes, spreadsheets and personal phones
- Reporting is built in. Evidence for funders, councils and NHS contracts comes out of the system rather than out of a spreadsheet rebuilt each quarter
This applies whether you run a volunteer led community transport scheme, a demand responsive transport service, SEND and home to school routes, or non emergency patient transport. The data sensitivity is comparable across all of them, and so is the obligation.
Frequently asked questions
What counts as legacy transport software?
Any system that no longer receives security updates, depends on hardware or an operating system past its end of support date, cannot exchange data with other systems, or relies on a supplier that has stopped issuing updates. Age alone does not make software legacy. Lack of support does.
Is it illegal to run transport software on an unsupported system?
There is no law banning it outright. However, UK GDPR Article 32 requires appropriate technical and organisational measures to protect personal data, and the ICO's security guidance sets out what that means in practice. Running unpatched software while holding sensitive passenger data makes meeting that standard considerably harder to demonstrate.
What are the biggest security risks of outdated transport software?
Unpatched vulnerabilities that stay open permanently, weak or absent encryption, limited access controls, and backups that have never been tested. Phishing remains the most common route in for UK organisations, and a legacy system offers fewer safeguards once an attacker has valid credentials.
How do I know if my transport system is out of support?
Check three things. First, the operating system version on any machine holding passenger data, and its end of support date. Second, whether your software supplier is still trading and still issuing updates. Third, when you last received a security update. If you cannot answer any of these, treat it as unsupported.
Does moving to cloud based transport software improve security?
In most cases yes, because patching, backups and infrastructure security move from a busy transport team to a supplier who does it continuously. It is not automatic though. Ask any prospective supplier where data is hosted, how access is controlled, how often backups run, and how you would export your data.
Who is responsible if passenger data is lost from a legacy system?
The organisation acting as data controller, which means the charity, council or operator rather than the individual coordinator using the system. Trustees and senior managers carry accountability for whether the technical measures in place were appropriate to the risk.
How long does it take to move off a legacy transport system?
It varies with the size of the service and the state of the existing data. Most schemes plan for a few weeks rather than a few months, with the bulk of the effort going into cleaning passenger records rather than the technical migration itself. Running both systems briefly in parallel reduces the disruption.
Sources
- Cyber Security Breaches Survey 2025/2026, Department for Science, Innovation and Technology and Home Office, April 2026
- Government cyber resilience, National Audit Office, January 2025
- Cyber threats: government defences outpaced by hostile states and criminals, Public Accounts Committee
- Security outcomes, Information Commissioner's Office
- GDPR security outcomes, National Cyber Security Centre and ICO
- Getting your organisation ready for Windows 11, National Cyber Security Centre, 2025
- End of support for Windows 10, Microsoft
- The UK's changing population, House of Commons Library
Ready to switch the lights on?
If you are not certain whether your current system is still supported, that uncertainty is itself the finding. We are happy to talk it through with no obligation, whether you are a small volunteer scheme, a council transport team or an NHS contract holder.
